CVE-2022-0381: Improper Neutralization of Input During Web Page Generation

The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the /swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and...

Embed Swagger <= 1.0.0 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the /swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 1.0.0. PoC...

WordPress Embed Swagger plugin <= 1.0.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Muhammad Zeeshan Xib3rR4dAr in WordPress Embed Swagger plugin versions = 1.0.0. Solution Deactivate and delete. This plugin has been closed as of January 24, 2022 and is not available for download. This closure is temporary, pending a...

org.openwfe:openwfe-embed (1.7.2), org.openwfe:openwfe-engine (1.7.2) +3 more potentially affected by CVE-2022-21363 via mysql:mysql-connector-java (3.1.13)

mysql:mysql-connector-java MAVEN version 3.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on mysql:mysql-connector-java and may be impacted: - org.openwfe:openwfe-embed 1.7.2 - org.openwfe:openwfe-engine 1.7.2 - org.openwfe:openwfe-sql 1.7.2 -...

GHSA-XRG3-HMF3-RVGW Path Traversal in rust-embed

When running in debug mode and the debug-embed off by default feature is not enabled, the generated get method does not check that the input path is a child of the folder given. This allows attackers to read arbitrary files in the file system if they have control over the filename given. The...

Path Traversal in rust-embed

When running in debug mode and the debug-embed off by default feature is not enabled, the generated get method does not check that the input path is a child of the folder given. This allows attackers to read arbitrary files in the file system if they have control over the filename given. The...

rust-embed directory traversal vulnerability

rust-embed is the embedding of static assets into rust binaries. rust-embed versions prior to 6.3.0 have security vulnerabilities that can be exploited by attackers in debug mode to cause directory traversal...

CVE-2021-45712

An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode...

CVE-2021-45712

An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode...

CVE-2021-45712

An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode...

Directory traversal

An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode...

CVE-2021-45712

An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode...

CVE-2021-45712

An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode...

CVE-2021-45712

The CVE-2021-45712 entry affects the rust-embed crate for Rust prior to 6.3.0. In debug mode, the generated Asset::get path traversal vulnerability occurs when the input path isn’t properly constrained, allowing ‘..’ segments to access files outside the assets folder. Documented analyses (OSV/RUS...

Rust Rust-embed crate path traversal vulnerability

rust-embed is the embedding of static assets into rust binaries. rust-embed versions prior to 6.3.0 have security vulnerabilities that can be exploited by attackers in debug mode to cause directory traversal...

CVE-2021-45712: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode...

GHSA-HG2P-2CVQ-4PPV Cross-site scripting in lazysizes

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

Cross-site scripting in lazysizes

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

Jenkins Report Info XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Jenkins Report Info. Authentication is required to exploit this vulnerability. The specific flaw exists within the PMD class. Due to the improper restriction of XML External Entity XXE...

PT-2021-24286

Name of the Vulnerable Software and Affected Versions: rust-embed crate versions prior to 6.3.0 Description: The issue allows attackers to read arbitrary files in the file system if they have control over the filename given, specifically when running in debug mode and the debug-embed feature is n...